go install github.com/1hehaq/shef@latest

echo -e "complete -W '\$(shef -list)' shef" >> ~/.bashrc && source ~/.bashrc

# get specific target's IPs and take web screenshots then view the images in terminal
shef -q org:tesla -f ip | sed 's/^/http:\/\//' | klik && yazi screenshots

# get related/own domains of the query, sometime it exposes internal portals (they shouldn't be same root domain)
shef -q hackerone.com -f domain # chain it with amass for getting more wide attack surfaces
# same for ports
shef -q hackerone.com -f port

# gets asn number(s) of the query then asn lookup with asnmap
asnmap -asn $(shef -q hackerone.com -f asn) # loop it if multiple asn numbers gets as shef's result

# gets relative domains and probe {title, IP, status code} then filter non 403 only (sometime, it shows real IPs, non WAF areas)
shef -q hackerone -f domain | httpx -sc -ip -title -silent | grep -vE '403|Cloudflare|Access Denied|Not Allowed'

# find known vulnerabilities of a product
shef -q "product:jboss" -f vuln